Ref: 2200n-24

May 2024

SBD Explores: Data Privacy

Data privacy, regulation, anddriver consent
10-minute Insight
Data from vehicles is used for positive outcomes. Data canhelp insurers understand the circumstances of an impact.
It can be used by fleet operators to check a vehicle is being
used appropriately, or by OEMs to help inform future
product improvements.
The storage and use of vehicle data is regulated, and theseregulations vary around the world. In the EU, there are
GDPR requirements. The USA does not regulate
automotive data at a national level, but some states haveintroduced specific requirements. Data is regulated inChina, but the requirements are different to those in USAand Europe.

In this edition of SBD Explores, we discuss the variation indata privacy regulation and highlight how some OEMs aremaking data consent more accessible.
Target audience
Product planning / Strategy

Focus market(s)GlobalEngineering
1What is happening?

1

Companies are keen to make use of vehicle data

Usage
Based Insurance

2

Productimprovement

6000

Number of variants

The availability of embedded connectivity in vehicles has
been increasing for the past 3 years, as shown in Graph
1. Embedded connectivity is fitted because it allows data
to be made available to off-car stakeholders.​ For
example to insurers to determine premiums, or to fleet
managers to check driver behavior. In some cases, only
data insights are shared off vehicle with no need totransmit raw data. Examples of the uses of data are:

Crash
Reconstruction

Key takeaways

Graph 1: Number of variants with embedded
connectivity

5000
4000
3000
2000
1000
02020

2022
EUChina2024
USA

Some vehicle data is in scope of privacy requirements
There is currently no comprehensive data protection framework at a federal level. There are sector-specificregulations that do apply to data protection or sharing. Most do not apply to the automotive industry. Somestates have introduced their own data privacy laws, but these are not harmonized at a federal level.

China has three data laws in effect. The Personal Information Protection Act is modeled on the GDPR andapplies with the same extraterritoriality rules. The Data Security Law classifies data collected and storedwithin China. The Cyber Security Law establishes a uniform regime for cybersecurity and“important data”.
The General Data Protection Regulation (GDPR) is the most stringent privacy and security law in the world,
effective since May 2018. Though effective in the E.U., it imposes obligations onto organizations anywhere if
they collect data from, or target products and services towards, E.U. citizens.

• Data protection requirements for vehicles are
not harmonized. Furthermore, general dataprotection requirements (not automotivespecific) are not harmonized.
• Harmonization of vehicle regulations ispreferred by OEMs. Harmonization allows avehicle or component to be developed for
multiple markets which saves costs andreduces complexity. Like with any otherregulations, differences in requirements createa homologation and compliance challenge.
Differences add cost and can result in features
not being made available in some regions.
• In Europe, OEMs must observe GDPR whencollecting and processing data. Some markets
outside of Europe are revising their dataprotection policies to more closely align withGDPR. OEMs not in Europe may choose toalign with GDPR to help compliance with thosemarkets• A customer’s informed consent to the use of
their data should always be obtained uponpurchase. ​This is slowing down the process of
onboarding vehicles into fleets. SBD report 643
contains more information on how an OEM candevelop a smoother consent process for fleet
operators.

2Why does it matter?
consent options
1 Customer
are important
In 2024, it was reported that vehicle owners werediscontent with General Motors sharing insurance
data with LexisNexis and Verisk. This affected
users' insurance premiums. The event has led tolawsuits against General Motors.
So far, across all industries, the number ofincidents related to data protection or privacy has
been increasing in the USA – as shown in graph 2.

To address the rise in incidents, data protection
regulations are spreading, and governments arelooking to make examples out of bad actors​.

2

Cybersecurity attacks have increased as theavailability of embedded connectivity has increased.
UN ECE Regulation 155 has been introduced andrequires manufacturers to conduct an exhaustive risk
assessment of potential threats.
Regulation 155 does not provide a definition for data
or data privacy, however. It also does not haveprovisions for the standardization of the process ofproviding users with the ability to manage dataconsent within the vehicle.

Annual number of data breaches

60in the USA

50

3500
3000

40

2500

30

2000

2015001000

UN ECE Cybersecurity
requirements don’t cover
data privacy

Total number of attacks per year
UNECE R 155 new types date
Embeddedconnectivity more
widely available in2021.

105000

2018

2019

2020

2021

2022

2023

Graph 2: Annual number of data breaches in theUSA over the years (not automotive specific) fromStatista02015 2016 2017 2018 2019 2020 2021 2022 2023

Key takeaways• Globally, the number of incidents involving
data protection or data privacy leaks isincreasing. The data in graph 2 is not
exhaustive, but indicative of a trend. UN ECE
R155 was introduced to help OEMs manage
cybersecurity risks but does not define data
privacy or set requirements on how to provide
in vehicle consent.
• Data sharing is not the problem. The issue lies
in how the data is being used and by whom.
• Being transparent with customers about how
their data is handled is also an importantfactor OEMs need to consider. For example,
customers could have saved money on
insurance premiums based on their driving if
their driving data is shared with the insurancecompany by the OEM. The customer’s consent
must be provided, and importantly, it must be
easy to manage consent preferences.

• The outcome is more interest from users in
where personal data is used and more of adesire to want control over how data is used.
The interest is not necessarily in regulation,
but in how best to provide the user withconsent options.

Graph 3: Shows the number of cyber attacks. Data
from SBD Report 905.
3

Who to watch out for?
Key takeaways
The data collection settings
in the IVI are not as
straightforward as those ofsome other OEMs. GM
does not disclose thelength of time for whichdata will be retained.
According to the Mozilla
Foundation, data deletion
could also be difficult.

Hyundai provides the user
with the ability to disable
data sharing for voicerecognition, GPS andphone information throughthe IVI. The controls allow
the customer to turn on
and off certain features,
including the service that
controls automatic crashnotifications.

BMW collects vehicle data,
including personalized
news. However, customers
can disable data collection
via the IVI system. They
can also choose the level ofdata privacy they needfrom the IVI system.

Tesla have made it easy
to enable and disable
data collection from theIVI. A user may enable
or disable the collectionof certain vehicle data
including Autopilot
Analytics &Improvements andRoad Segment Data
Analytics.​

Toyota allows customers todisable data collection via
the IVI system and choose
different levels of data
sharing when setting up
their profile. Customers canalso view the terms of useof their data.

Nissan provides consent
prompts whenever aconnected feature isopened. Consent prompts
are only otherwise available
when logging into theportal and app and can beviewed throughboth channels​.

• SBD expects privacy to become adifferentiator for many brands (particularly inthe premium sector), who will build into theirvehicles new types of privacy experiences.
• The automotive industry can focus on
harmonization of the method for a user toprovide, or revoke, data consent. The degreeof ease with which the consumer canunderstand and control who has access totheir data and how it is being used will be adifferentiating factor for OEMs.
• The important thing is to focus on the processof allowing the user to manage data consent
options from the vehicle infotainment screen.
Requiring the user to visit a website is notfollowing the principal of privacy andaccessibility by design.
• Making it easy to manage consent isimportant. The next step is to determine how
to link consent preferences with an individual
person, not link with a vehicle. Some vehicles
may have consent in place when passed onto
second owners for example (without theOEM’s knowledge). The second owner may
have different preferences.

4

Where Next?
Key takeaways
1

Continue tomonitor data
privacy
regulations

Improvements
of in-vehicle
data consent
options2

FutureOutlook
Automaticadjustmentof consent
fordifferent
users
More data
regulation but notnecessarily more
harmonization

Now

2-6 yrs.

3

4

6-8 yrs.

8+ yrs.

The automotive sector has some data protection
regulations, but they vary in each region. Given thefast pace of development, OEMs should monitor
development to ensure you are aware of any
overlap in requirements or duplication of work.

Improving depth and accessibility in the vehicle
could be the first step. Systems with more depth
could give consent prompts, allow the disabling ofconsent for third party applications and allow theviewing of documents.
The next stage may be the development of a wayof verifying the identity of the user so that consent
preferences can be adjusted automatically. Asystem that can tell who the user is. Also, effort
may be put into developing an off-board server fordata analysis and management, and on-board
system serving as a ‘lock’.

Part of data protection is a political decision, andeven if harmonized requirements are put in place,some countries may choose to opt out or put inplace their own requirements. In the long term, it
may be a reasonable to expect data protection
requirements to still be fragmented.

• All trendlines point to consumers caring more
about privacy. Expect privacy start-ups toflourish, offering new types of data
anonymization and giving consumers greatercontrol.
• Some car makers are already working towards
positioning themselves as leaders in dataprotection and privacy. This could be a leader
both data security and accessibility of consent
controls.

• In SBDs view, it is unlikely that countries will
harmonize their national legislation. This
would require political will and dedicatedresources. OEMs will have to accept this. Whatcan be harmonized, however, is the process ofproviding consent and verification of who isproviding consent. This may happen.
• In preparation for potential future pressures, itis recommended that OEMs work on a process
for ensuring that the correct data consent
preferences are selected. For example, if afamily have access to a vehicle, the vehicle
should be able to know who is driving andadjust consent options depending on thedriver.

5How should you react?

12
3Authors
Monitor the progress ofany privacy standards being
drafted

Identify OEMs providing

Linkedin Free
socialmedia

Kurian Valiyaveettil Kurian
Research Analyst

Michael Levet
Senior Analytical
Reports Specialist

Related SBD Reports

data consent options in thevehicle, and any innovative
designs
528 – Connected Car Legislation Guide

Improve the ability of thevehicle to adjust consent
automatically depending on
the driver

643 – Fleet management solutions

Related SBD Consultancy▪ Competitive Assessment▪ Market Landscape▪ Due Diligence▪ Strategic Advisory

Interested in finding out more?
Most of our work is helping clients understand new challenges andopportunities through individual projects. If you would like todiscuss recent projects that we’ve completed, please contact us.
6